webapp/bookstack
1
0
Fork 0
mirror of https://github.com/BookStackApp/BookStack.git synced 2025-06-11 13:48:13 +03:00
Code Activity

Prevented normal users from changing own email

Browse Source 
To address #1542

Updates to only allow email changes by users with the users-manage role
permission.
This commit is contained in:
Dan Brown
2019-08-06 21:29:42 +01:00
parent 2955f414dd
commit f417675b1d
4 changed files with 45 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
app/Http/Controllers/UserController.php
View File

@ -146,7 +146,12 @@ class UserController extends Controller
]);
$user = $this->userRepo->getById($id);
$user->fill($request->all());
$user->fill($request->except(['email']));
// Email updates
if (userCan('users-manage') && $request->filled('email')) {
$user->email = $request->get('email');
}
// Role updates
if (userCan('users-manage') && $request->filled('roles')) {